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In recent years, the gap between theory and practice in quantum key distribution (QKD) has 
been significantly narrowed, particularly for QKD systems with arbitrarily flawed optical receivers. 

The status for QKD systems with imperfect light sources is however less satisfactory, in the sense 
that the resulting secure key rates are often overly-dependent on the quality of state preparation. 

This is especially the case when the channel loss is high. Very recently, to overcome this limitation, 

Tamaki et al proposed a QKD protocol based on the so-called “rejected data analysis”, and showed 
that its security—in the limit of infinitely long keys—is almost independent of any encoding flaw 
in the qubit space, being this protocol compatible with the decoy state method. Here, as a step 
towards practical QKD, we show that a similar conclusion is reached in the finite-key regime, even 
when the intensity of the light source is unstable. More concretely, we derive security bounds for 
a wide class of realistic light sources and show that the bounds are also efficient in the presence 
of high channel loss. Our results strongly suggest the feasibility of long distance provably-secure 
communication with imperfect light sources. 


I. INTRODUCTION 


The gist of quantum key distribution (QKD) [H-Q is that it allows two remote parties, Alice and Bob, to establish 
common secret keys in the presence of an adversary. Eve, who may have unlimited computing resources and techno¬ 
logical advances. Today, three decades after its introduction, QKD has made enormous progress in both theory and 
practice, and is arguably on the verge of global commercialisation. Having said that, however, there are still some 
issues, both theoretical and experimental, that need to be resolved before we can reach that level. Amongst those, 
the most pressing one is the mismatch between device models used in security proofs and actual devices used in 
QKD systems. In particular, such implementation loopholes can lead to side-channel attacks that break the security 
of QKD. Notably, it has been repeatedly demonstrated that the behaviour of single-photon detectors employed in 
QKD systems can be externally controlled, simply by exploiting their physics [^. In this case, it is easy to verify 
that security cannot be achieved, since the measured data are not representative of the quantum channel [^. Un¬ 
doubtedly, such hacking demonstrations raise not only the importance of proper calibration of QKD systems, but 
also the importance in developing security proof techniques that can tackle modeling discrepancies. Indeed, in the 
past few years, much attention has been devoted towards the development of such proof techniques and side-channel 
countermeasures, particularly in the areas of security of finite-length keys and detector side-channel attacks 

[uHIl. 


Amongst these theoretical results, only a few considered the issue of state preparation flaws—despite that it is 
a commonly faced experimental problem. More concretely, typical light sources used in QKD systems are not true 
single-photon sources and practical optical modulators employed to encode the light pulses are inherently limited in 
precision. The former can be resolved by using the decoy-state method which allows QKD systems based on 

practical light sources to achieve the security performance of single-photon QKD. The latter, however, does not have 
an adequate solution. In particular, it has been firstly shown by Gottesman et al [isj ] that such inaccuracies in encoding 
can lead to very pessimistic secret key rates in the presence of high quantum channel loss. Also, other works show 
similar results |19| . This strong dependency on channel loss is primarily due to the fact that state preparation flaws 
can be seen as a form of basis information leakage, which gives Eve some advantage in formulating basis-dependent 
attacks. Crucially, as shown in BEl, Eve’s advantage can be significantly enhanced by exploiting channel losses. 
Consequently, this heavily penalizes the secret key rate whenever the channel loss is substantial. 

Very recently, a loss-tolerant QKD protocol has been proposed by Tamaki et al as a means to overcome typical 
encoding flaws in QKD systems. More specifically, as briefly mentioned earlier, here we are considering encoding 
flaws due to imprecise alignment of optical modulators. For example, if the quantum states are encoded into the 
polarisation degree-of-freedom of photons, an encoding flaw could be due to a misalignment in the wave-plate used 
to set the desired polarisation. The protocol is similar to the Bennett-Brassard 1984 (BB84) QKD scheme 2l|, but 
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FIG. 1: In each trial, Alice’s laser emits two consecutive coherent pulses representing the signal and the reference pulse. For 
this, she first uses an amplitude modulator to select the pulses’ intensity k £ K. After that, she applies a phase shift {0, tt, 7r/2} 
to the signal pulse. On reception. Bob splits the received pulses into two beams and then applies a phase shift {0, —7r/2} to 
one of them. Also, he applies a one-pulse delay to one of the arms of the interferometer and then recombine the pulses at a 
50:50 beamsplitter (BS). A “click” in detector DO (Dl) provides Bob the key bit y' — 0 {y' = 1). 


instead of considering all the four BB84 states, it uses only three of them. Interestingly, by considering statistics 
beyond those of the BB84 protocol, the resulting secret key rate is the same as the one of BB84’s 23-26|. More 
importantly, the secret key rate has the very nice property in that it is almost independent of encoding flaws. These 
results imply that the usual stringent demand on precise state preparation can be considerably relaxed and one only 
needs to know the prepared states. Additionally, it is useful to mention that most current BB84 QKD systems can 
easily switch to the loss-tolerant QKD protocol without much hardware modifications. 

In anticipation that the loss-tolerant QKD protocol will be widely implemented in the near future, we extend the 
sec urity analysis in Ref. to the finite-key regime, i.e., we derive explicit bounds on the extractable secret key length 

(in 27| , the authors have implemented the loss-tolerant protocol experimentally with careful verification of the qubit 
assumption used in the protocol. This paper also includes some finite-key analysis of the protocol. Unfortunately, 
however, its phase error rate estimation seems to be valid only against collective attacks). Furthermore, our bounds 
can be applied to a wide range of imperfect light sources—including typical cases whereby the intensity of the laser is 
fluctuating between a certain range. Also, the security bounds are obtained within the so-called universal-composable 
framework and thus secret keys generated using these bounds can be applied to other cryptographic tasks 

like the one-time-pad. In order to investigate the feasibility of our results, we consider a QKD system model that 
borrows parameters from recent fibre-based QKD experiments. With this realistic model, our numerical simulations 
show that provably-secure keys can be distributed up to a fibre length of about 120 km, even when only 10^^ signals 
are sent by Alice to Bob. 

This paper is organised as follows. In section It, we describe some assumptions that we made in our security analysis 
and after that we introduce our protocol. In section IE, we give the security definition of the protocol and provide 
the formulation of the extractable secret key length. In section IV, we present the results of the parameter estimation 
using the decoy-state method for two different cases: an exact intensity control case and an intensity-fluctuation case. 
Then, in section V, we simulate the key generation rate for both scenarios. Finally, section VI concludes the paper 
with a summary. The paper includes as well some Appendixes with additional calculations. 


n. ASSUMPTIONS AND DESCRIPTION OF THE PROTOCOL 
A. Assumptions on Alice and Bob’s devices 

Prior to stating the actual protocol, we first describe the assumptions on the user’s devices. 

We consider that Alice’s transmitter contains a laser source, an amplitude modulator and a phase modulator. 
See Fig. [TJ The laser is single-mode and emits signals with a Poissonian photon number distribution. Also, we 
assume that Alice encodes the bit and the basis information in the relative phase 0 a between a signal and a reference 
pulse, whose joint phase is perfectly randomised Let us emphasise, however, that the security proof that we 
provide in this paper applies as well to other coding schemes like, for instance, the polarisation or the time-bin coding 


^ Note that the recent work shows that discrete phase randomisation is sufficient for in a BB84 protocol [soll . 
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schemes. Next we present the two types of imperfections that we consider for Alice’s device. 

1. Intensity fluctuations. 

The fluctuation of the intensity of the emitted coherent light is typically due to the laser source and imperfections in 
the amplitude modulator. Here we shall consider that Alice does not have a full description of the probability density 
function of the fluctuations, but she only knows their range ^. That is, she knows that the intensity k of the emitted 
coherent light lies in an interval k € [k~^k'^\ except with error probability Cinten, where is the upper (lower) 

intensity. For simplicity, we shall assume that einten = 0. If Cinten > 0 this error probability can be directly taken 
into account through the security parameter Csec whose definition is referred to equation (IdH)) . The intensities of the 
signal and reference pulses are := kV and := fc(l — V) respectively, with 0 < H < 1. 

In section IV. A we study the case where k = k~ = k~^, i.e., there are no intensity fluctuations. After that, in 
section IV. B, we evaluate the typical scenario where > fc“. 

2. Imperfect encoding of the bit and basis information. 

In our protocol, Alice chooses the relative phase Oa at random from {0,7r/2, tt} to encode the bit and basis 
information. The phase 6a G corresponds to the Z basis states which are selected with equal probability, and 

0A = 7r/2 denotes the X basis state. Alice assigns a bit value 2 / = Oto0AG{O,7r/2} and a bit value y = 1 to 6 a = t^. 

Due to the misalignment of the optical system, however, the actual relative phase prepared by Alice may deviate 
from the desired angle 6 a by a factor Ad a- Hence, we have that the actual state Alice sends to Bob can be typically 
described as 


/■2Tr 


p(A0a)P 


dA6»A. 


( 1 ) 


Here, we define P[-] = |•)(•|, the parameter y € [0, 27r) is a random phase, the state |a)s(r) is the coherent state of the 
signal (reference) pulse, and p(A0a) is the probability distribution of A6a. 

Alice does not need to know the origin of the encoding errors A6a, but we assume that she knows p{A6a). Also, 
we assume that p{A6a) is independently and identically distributed for each run of the protocol. Moreover, we 
consider that there are no side-channels in Alice’s device. 


Assumptions on Bob’s apparatus 

We consider that the detection efficiency of Bob’s detectors is independent of his measurement basis choice. A phase 
value 0B = 0 (0B = ~7’‘/2) corresponds to a device parameter to choose the Z (X) basis for the measurement. 
Also, like in the case of Alice, we consider that Bob uses an imperfect phase modulator that shifts the phase of the 
incoming signals by 0 b + A0b, where A0 b is the modulation error. Note, however, that this last assumption is not 
needed in the security proof; we use it only for simulating the resulting secret rate. Furthermore, we assume that 
there are no side-channels in Bob’s device. 


B. Protocol description 

We study a three-state protocol that uses one signal and two decoy settings. Also, we consider that the protocol 
employs an asymmetric coding, be., the Z and the X basis are chosen with probabilities Pz and Px = 1 — Pz, 
respectively. The secret key is extracted only from those events where both Alice and Bob select the Z basis and the 
signal setting. In addition, we assume that Alice and Bob do not implement a random sampling procedure to estimate 
the bit error rate, but they perform error correction for a pre-established fixed value of it. The error verification step 
of the protocol (see Step 5 below) informs them about whether or not the actual residual bit error rate exceeds the 
considered value. 

The protocol runs as follows. 


Actual protocol 


^ Note that in those scenarios where Alice knows the exact probability distribution of the fluctuations then the conventional decoy-state 
method can be directly applied. 
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First, Alice and Bob decide a security parameter Cgec whose definition is referred to equation (gni). Then, 
they repeat the first three steps of the protocol for i = 1,..., until the conditions in the Sifting step are met. 

1. Preparation 

For each i, Alice randomly chooses the intensity k G K = {fcg, fcdi, fcd 2 } with probability pk^, pk^^ and 
Pkd 2 = 1 ~ Pks ~Pkdn respectively. The intervals [k~, fe+J where the different intensities lie have to satisfy k^^ > k '^2 
and k~ > + k^ 2 - Then, Alice randomly selects the basis a G {Z,X} with probabilities p^ and p^, respectively. 

Next, she chooses at random the signal phase 0a G {0,7r} when she selects the Z basis, and she chooses 6a = 
when she selects the X basis. Finally, she generates the signal and reference pulses following these specifications 
and sends them to Bob via the quantum channel. 

2. Measurement 

Bob measures the incoming signal and reference pulses using the measurement basis b G {.Z, X}, which he randomly 
selects with probabilities Pz and Px, respectively. The outcome is recorded in d € {0,1, T,0}, where T and 0 
represent the double click event and the no click event, respectively. If d =T, Bob assigns a random bit to it As 
a result, he obtains y' = {0,1,0}. 

3. Sifting 

Alice and Bob announce their bases and intensity choices over an authenticated public channel and identify the 
following sets: Zk '■= {i\a = b = Z A Intensity = k A y' 0 }, := {*!« = b = X A Intensity = k A y' = jj, 

:= {i\a = ZAb = AAlntensity = kAy = 0 {l)Ay' = j} a,nd XZl := {i\a = XAb = ZAlntensity = kAy' = j} 
with j G {0,1} and k G K. Then, they check if the following conditions are met: \Zk\ > Nz^, 
\Xl\ > N^3 ^,\Z°^^'>xI\ > A^ 20 (i)x£ \^^k\ — ^xzl J ^ {0; 1}; k G K, and for certain pre- 

established values Nz^, N^j, and where | * \ represents the length of the set +. 

We denote by N the number of pairs of coherent states {i.e., signal and reference pulses) sent by Alice until these 
conditions are fulfiled. We denote Alice and Bob’s sifted keys as {Za,Zb)] their size is \Za\ = \Zb\ = 

4. Parameter estimation 

They estimate the number of events TOo(i) where Alice emitted the vacuum (the single-photon) state within the set 
Zk^. Their expression is given by equations (1121) and (1181) for the scenario without intensity fluctuations, and by 
equations (l23)) and ((Ml) for the case with intensity fluctuations. Also, Alice and Bob estimate Nph, i.e., the number 
of the so-called phase errors in the single-photon emissions within the set Zk,, (see equation (IMl) ). They check if the 
phase error rate Cph := Np^/mi is lower than a predetermined threshold value e^, which corresponds to the phase 
error rate associated with a zero secret key rate (see equation ([2|)). If Cph > they abort the protocol; otherwise 
they proceed to step 5. 

5. Postprocessing 

Alice and Bob perform error correction over an authenticated public channel for {Za, Zb). This step consumes at 
most Aec bits. Finally, they implement an error verification step and, after that, they perform privacy amplification 
using a hash function that extracts a secret key pair (Sa, Sb), where I^aI = |S'b| = ^ bits. 


m. SECURITY BOUNDS 


The security of a QKD protocol is characterised by its correctness and secrecy. That is, following the universal 
composable security framework [iilii, the protocol is called Cgec-secure if it is both Cc-correct and Cg-secret, where 
Csec = Ec + Es- Here, the correctness criterion is met whenever the output keys, Sa and Sb, are identical. More 
generally, for some small error in the correctness, we say that the protocol is Cc-correct if Pr[S'A yf ^b] < Cc is met. 
For the secrecy criterion, it is met whenever the joint classical-quantum state describing Alice’s output key and Eve’s 
quantum system is of the following form, Ua Z) Pe, where Ua is the uniform distribution over all bit strings, and pE 


^ Note tliat this random assignment is not mandatory, and Bob can always choose a particular bit value, say 0, for d =± as this preserves 
the basis-independence detection efficiency condition. 
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is an arbitrary quantum state held by Eve. Likewise, for some small error eg, we say the protocol is Cg-secret if 

^IIPSaE - 0 PeIIi < Cg, 

where psaE is the joint state shared by Alice and Eve. Note that || • ||i is the trace norm defined as || • ||i = Tr-\/A. 
Using these security definitions, it can be shown (see Appendix A for details) that a lower bound on the secret key 
length for the protocol described above 


> 


m^ + m\[l-h{e^^)\-\og^ 




- AeC - log2 


( 2 ) 


where h{x) = —a;log 2 a; — (1 — a;)log 2 (l — x) is the binary entropy function, TOo(i) ^ lower bound on mo(i)i 
Gph := <h/ m\ is an upper bound on the phase error rate, and 77 is the sum of the failure probabilities when 
estimating toq and Cph. This last parameter is upper bounded by 77 < 1 — E^^gE^pEph, where E^^O: Ez,i and Eph are 
the failure probabilities associated to the estimation of itiq, m\ and to the upper bound on the number of the phase 
errors fVj^, respectively. 


IV. PARAMETER ESTIMATION 

In this section, we briefly describe the estimation procedure to obtain ttiq and . Also, we provide an expression 
for The detailed calculations are included in Appendix D. 

As mentioned in section H. B, we assume that the phase of each pulse generated by the laser is perfectly randomised. 
This means, in particular, that we can regard the signals sent by Alice as a classical mixture of Fock states, each 
of them representing the total number of photons contained both in the signal and in the reference pulse. That is, 
the probability that Alice emits a pulse with n photons conditioned on the fact that she selects the intensity setting 
k G K is written as 

un 

p{n\k) = — . (3) 

n! 

Also, from the property of the decoy state method we have that the total number of detection events when both Alice 
and Bob use the Z basis is given by 

00 

fceif n=0 

where Sz,n represents the number of detection events when Alice and Bob used the Z basis and Alice emitted an 
r7-photon state. 


A. Estimation of the number of vacuum and single-photon contributions for the exact intensity control case 


We consider first the scenario without intensity fluctuations in the source, i.e., when k = k~ = k'^. 

Owing to the use of decoy-states 15l-ll7l|. it can be shown that Eve cannot obtain any useful information about 
Alice’s intensity choice if she observes an n-photon state in the quantum channel. Therefore, it can be demonstrated 
that the actual protocol, where Alice chooses the intensity of each signal before she actually sends it to Bob, is 
equivalent to a counterfactual protocol described as follows. First, Alice prepares and sends 7 T.-photon states to Bob. 
Then, Bob measures all the signals received from Alice. Afterwards, Alice decides the intensity setting for each signal. 
Due to this equivalence between the actual and the counterfactual protocols, we have that the number of detection 
events \Zk\ for setting k G K within \Ztot\ has the form 


\Zk\ — {Zk) + Sk, 


( 5 ) 


except with certain error probability that will be introduced later on, and where {Zk) denotes the mean value of \Zk\ 
given by 

00 

{Zk) = '^p{k\n)Sz,n 

n—0 


( 6 ) 
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The parameter 6k that appears in equation (O denotes the deviation between the experimentally obtained quantity 
\Zk\ and its expected value. The convergence of Sk is discussed in Appendix B. 


a. Estimation of the number of vacuum contributions 


At first, we calculate a lower bound on mo, the number of events in Zk„ that originate from a vacuum state sent by 
Alice. We define the mean value of toq as fj-o = Piks\0)Sz,o- Now, by applying Lemma 1 from Appendix B we obtain 
that 

mo > po — ^z,o, (7) 

except with certain error probability e^o: where the deviation A^q is given by A^q = ScCmoiCz.o) with gcix,y) = 
^J2x\n\/y. So far, the lower bound on mo depends on the unknown mean value yo which cannot be directly observed 
in the experiment. According to the definition of fj,o, however, this problem can be solved by estimating a lower bound 
on Sz,o- For this, we use a result from Q. In particular, we have that 


Sz,o > 


p{0) 


{Zk,,) - =: Slo, 

Pfcdi 7 


fcdl — kd2 ^ P/Cd2 


( 8 ) 


where p{0) = P{^\k)- To estimate the mean values (Zk^^) and oan employ either Lemma 2 or 

Lemma 3 introduced in Appendix B, such that the fluctuation is minimised. In so doing, we obtain a lower bound on 
together with an upper bound on {Zk,^^) given by 


(-2' fed2) := I■^fcd2l “ nun|gM(|-^fcd2|, (e“o)^^^)!5H(|^tot|,e|‘)o)|, 

(Z+fc,,) := +min{gM(|^fcdi|,(e|?o')Vl6),5H(|Ztot|,e|'o')}, 


(9) 

( 10 ) 


where gM{x,y) = \/2x\nl/y and g]d{x,y) = ^Jxj2Pm\Jy. The failure probability associated with the estimation of 
(Zfe), with k G {fcdi, fcd 2 }, is either given by q = o t)y o = o + z o; depending on which Lemma {2 or 
3) we use. As a result we find that 


Pk„e 


kg 


Po > Pih\o)s^^o > r‘ , 

^dl ^d2 ' Pkd2 


-{Z fcd2/ - 


Pkdi 




=■ Mo: 


( 11 ) 


which only depends on known parameters. Note that in equation m we have used the fact that p(fcs|0) = 
Pfe^p(0|fcs)/p(0) = Pks^~^‘/p{^) in combination with equation ([8]). We finally obtain, therefore, that 


mo > Po ~ ^z,o =■ 


‘0 > 


( 12 ) 


except with error probability ez,o = ez,o + £^zo + ^z^o- 


~kd2 


b. Estimation of the number of single-photon contributions 

Here, we calculate a lower bound on the number of single-photon pulses sent by Alice that contribute to Zk^. For 
this, we use a similar technique to the one described in the previous section. In particular, let pi be the mean value 
of mi, which is given by pi = p(A:s|l)S'z,i- Then we have that 


mi> pi- Azp, 

except with error probability ez,i, where A^.i = gcipi,iz,i)- From Ref. 


(13) 


we have that 


Sz,i > 


p{l)ks 


rgfcdi 


(fcdi - kd2)iK - kdi - kd2) Lpfedi Pk,, ^ 


okd2 


Ml 


/i 

M2 ( 


’Z,0 


kl Vp( 0 ) 


'-{Zk,) 

Pk, 


=: 


Z,l’ 


(14) 
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where p(l) = 'Yhk^KPk As before, by using Lemmas 2 and 3 from Appendix B we obtain a lower bound on 

(-Z’fejj), and an upper bound on and {ZkJ. They are given by 

(Z-k,,) ■■= -min{gM(|^fedi|,(4"i'f/^),5H(|^tot|,e|"i')^ (15) 

{Z+k) ■■= |Zfe|+min{gM(|^fc|,(4.i)Vl6),5H(|^tot|,e|,i)}, (16) 


where the second equality holds for k G {k^, k^ 2 }- The failure probability associated with the estimation of (Zk) (with 
k G K) is either given by e| ^ = ^z.i 1 = 1 + ^h.z n depending again on which Lemma {2 or 3) we apply. 

By employing the relation p(fcs|l) = Pki,p{Mks)/p{l) = pk^kse~^’^/p{\), we obtain a lower bound on /j,i, which only 
depends on known parameters, 


Pi > p(fcs|l)S'ii 


> 


PkMe 


2^ — /cs 


(fcdi - kd2)iks - kdi - kd2) Lpfedi Pki2 


3fcd2 


IP- — ]P 

^dl 


d2 , 


Po 


fc2 Vp(fcsAO) 


PK ' 


=: p^. 


(17) 


Therefore, we have that 

> Ml - Az.i =: rn\, (18) 

except with error probability £z,i = J2n=o(Pn + Pn) + i> where the parameters and e^'‘g come from 

the estimation of /ig ■ 


B. Estimation of the number of vacuum and single-photon contributions for the intensity-fluctuation case 

We now evaluate the scenario where the laser suffers from intensity fluctuations. As introduced above, here we 
shall assume that Alice only knows the range \k~, fe+J where the intensity value k lies. Below we introduce the final 
expressions for the different parameters; the detailed derivations are referred to Appendix C. 


a. Estimation of the number of vacuum contributions 


Here, we present the result for the estimation of the lower bound on Tz^. Here, T^ q is the sum of the conditional 
probability that Bob detects a signal in the Z basis conditioned that Alice chooses the signal intensity and sends a 
vacuum state in the Z basis (see equation (IHT]) !. It is given by 


Tz,o > 



1,+ pk 


Pkdi 


-{Zkdd)) 


_. rr-iL 


(19) 


To calculate the mean values {Zk^i) and {Zk^^) we employ Azuina’s inequality, which is described in Lemma 4 (see 
Appendix B). Importantly, note that this inequality holds without assuming independence of the trials. As a result, 
we obtain a lower bound on (Zk^-i) together with an upper bound on (Zk^^)- They are given by 


{Z-kd2)--=\Zkd2\-9A{N.,e%^S), ( 20 ) 

{Z+kdd):=\ZkdA+9AiN,.ef,^), ( 21 ) 


where gA{x,y) = \/2x \n{\/y), and is the number of events where Alice and Bob use the Z basis within N trials. 

In so doing, we find a lower bound on go that only depends on parameters that are directly observed in the 
experiment. It has the form 


Po ^ P {kg A 0)T^ q 

■,-kt , U- „k 


> 


Pk,e 


'^dl '''d2 


Pkd2 


(ZkJ- 




P^dl 


^dl 


=: Mo, 


( 22 ) 















where the p {kg A 0) is a lower bound on p{ks A 0). 

Finally, we obtain a lower bound on mo which is given by 

mo > Pq - Az,o ='■ mg, (23) 

except with error probability ez,o = ^z,o + ^z^o + ^z^o¬ 


b. Estimation of the number of single-photon contributions 

Here, we introduce a lower bound on Tzp- Here, Tz,i is the sum of the conditional probability that Bob detects 
a signal in the Z basis conditioned that Alice chooses the signal intensity and sends a single-photon state in the Z 
basis (see equation ((701) 1. 

It is given by 


Tz,i > 


e^di 

(^di - ^d2)(^s“ - fcdi - ^d2) 

=: T^,i- 


t.+ 

e d 2 


Vkd2 


{kt,? - {k^2? (f 

'Pk, 


—{Zk,,) - — {—(Zk.) - Tf 


[kg 


z,o . 


(24) 


Again, to estimate the mean values (Zk^^), (Zk^^) and {ZkJ we employ Lemma 4- This way we obtain a lower bound 
on {Zk^^) and an upper bound on (Zk^^) and (Zk^) as 


{Z-k,,):=\Zk,A-9AiN,,e’tl), 
{Z^k) ■= \Zk\ + gAiNz, (-za)^ 


(25) 

(26) 


where the second equality holds for fe € {fcg, fed 2 }- 

Hence, a lower bound on pi can be directly written as 


pi>p {kg A i)r|'_i 

-^^{k-f 


> 


Pk,e 


rgfeji 


(^dl k^2){ks fcji ^^ 2 ) ^Pkdl 


e d 2 


^ZkJ - - 




Pkd2 


{h 


-\2 




Mo 


p-{kg AO)/. 


= : Ml, 


where p {kg A 1) is a lower bound on p{kg A 1). 

Finally, we obtain m\ as 

mi> p\- Az,i =■■ mi, 

except with error probability ez,i = I^t.=o(^z% + ^’z%) + + ^’z.v 


(27) 


(28) 


C. Estimation of the number of phase errors 


In this section we present an upper bound on A^ph, which is the number of phase errors in the single-photon emissions 
within the set Zk^. As already mentioned in section II. B, the states sent by Alice are given by equation ([1]), and we 
assume that the distribution p(A0a) is known to Alice. 

We denote the single-photon part of equation m as p{0a)', it is given by 


p{dA) = 


n2n 

I ^ 


p{^^a)^ 


cri + 


27 


1 + 7' 


■ ^ cos(0A 4- A0a)<7z + sin(0A + A0a)o'x^ 


1-7^ 
1 -b 7' 


rcry 


dA 0 A, 


(29) 


where the parameter 7 = Here we define the eigenvectors of the Pauli operators ay^az and ax as: 

|0y) = |l)r|0)s, |ly) = |0)r|l)s, jOz) = (|0y) + |ly))/-\/2, |lz) = ( —*|0y) + i\\y))/\/2 and \ix) = (IO 2 ) + {—\y\\z))/'/^ 

with i G {0,1}. The state |n)r(s) denotes an n-photon number state of the reference (signal) pulse. 

With this notation, the single-photon part of the three states sent by Alice can be expressed as poz = m(0), piz = p{x) 
and pox = m( 7’'/2). Let ps = (o’/ + (? ■ Hs)/2, where a = [cta, <^z\ and the Bloch vector Vs = [V(|, Vy,V§] is a real 
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three-dimensional vector that satisfies |l?s| < 1 with S G {0z,lz,0x}. From we have that if Vy ^ 0, the phase 
error rate of poz and p\z is equivalent to that obtained after the application of the following filter operation, 


Fy = (1 + ^l-VY/^l + VY)P[\Qy)] + 2Vy/{-1 + Fv + ^l-V^)P[\ly)]. (30) 


This means, in particular, that we can restrict ourselves to the estimation of the phase error rate of the states ps 
which lie in the ax-<yz plane. 


FyPsFI ^ + + 

Tt[fIFyPs] ~ 2 


(31) 


where the parameters rf and rf are given by rf = VxfiVy) and rf = /(Vy) with /(Vy) = l/-y^l — Vy- The 

states PS given by equation dSU can also be decomposed as 

ps = ifP[l4^)]+PfP[|<('f)], (32) 


where the probabilities Pf have the form 

/^^ = i(i-(-i)y(a2+(rf)2), 

and the eigenvectors are given by 


1 /^f-(-i)VFg)^-Kr-f)^ 


JT 


= { I*.) 


|0z) -I- |lz)^ 


=: af|0z) -h6f|lz), 


{rx ^ 0) 

(ra: = 0 A Tz < 0) 
(r,z = 0 A Tz > 0) 


for i G {0,1}, and where Af is the normalisation factor of the state. 

After some lengthy calculations (see Appendix D for details), we obtain that A^ph is upper bounded by 


(33) 


(34) 

(35) 


1 

A'ph^ ^ 


P{s + 1) 


f^o2{l + (-l)^(/f5^ 








+ (-1)^ E (3) + Ct,iiVMx,(4) +C,.2iVMx,(5)} 

=* n\ 


I A sei 


(36) 


except with error probability eph- Here, the terms NmxsU) with j G {3,4,5} are defined in equations (I^ - (IM1) : the 
quantities F(l) and P{2) are given by equation (l82l) : the parameters Ct^i have the form Ct^i := -I- + 

{a^^bl^ + bf^al^)A^l + — bf^bl^)A 2 l ior I G (0,1, 2}; the coefficients A~j are the (i,j) element of the following 

matrix 


, /2(r},^r°^ — 2(r°^r°^ — 2(r°^r}^ — 

A~^ := — I 2(r}^ — r°^) 2(r°“ — r°^) 2(r°^ — rl^) | , 

^ V 2(r0- - rl^) 2(r0^ - 2{r°/ - ) 


(37) 


where Q := 


(r^^ — r'l^) + +''"x^ {’>'1^ — ); 


and the fluctuation term is given by equation (IMI) . 


V. SIMULATION OF THE KEY RATE 

In this section, we show the simulation result for a fibre-based QKD system. Alice chooses the intensity of the laser 
from the set {ks, kdi,kd 2 }, where we fix the intensity of the weakest decoy state to kd 2 = 2 x 10“"^. This is so because, in 
practice, it is difficult to generate a vacuum state due to the imperfect extinction of the amplitude modulator. Also, 
we assume that Bob uses an active measurement setup with two single-photon detectors with detection efficiency 
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FIG. 2: (Colour online) Secret key rate (per pulse) in logarithmic scale vs fibre length for the case with exact intensity control. 
The security parameter is Csec = 10“^° and the total number of signals sent by Alice is = 10® with s = 9,10, 11 and 12 (from 
left to right). The rightmost two lines correspond to the asymptotic secret key rate with two decoy settings. The solid lines 
denote the case ^=0 {i.e., the perfect encoding scenario) while the dashed lines show the case ^=0.147 which is equivalent to 
a phase modulation error of 8.42° (this error parameter is measured in an updated version of a commercial plug&play system 
(ID Quantique Clavis2) [ 13 ]). The experimental parameters are described in the main text. 



FIG. 3: (Colour online) Postprocessing block size \Zks \ vs fibre length for a fixed total number of signals N = 10® sent by Alice 
with exact intensity control, with s = 9,10,11 and 12 (from left to right). The solid lines correspond to the case ^=0 and the 
dashed lines are for ^=0.147. 


77det = 15% and a dark count probability pd = 5 x 10“^. The attenuation coefficient of the optical fibre is 0.2dB/km 
and its transmittance is rych = 10“°-^^/^° with D denoting the fibre length. The overall misalignment error of the 
optical system is fixed to be Cmis = 1%- In addition, we assume an error correction leakage Aec = /Ecl^fcs 
where is the bit error rate of the sifted key Z^)- Moreover, for simplicity, we consider that the error correction 
efficiency of the protocol is a constant number /ec=1-16 which does not depend on the size of Z^^. For simplicity, we 
model the imperfection of Alice’s (Bob’s) phase modulator as A0 a = (A0b = —A0a). Also, we consider that 

the intensity fluctuation of the laser source lies in the interval [fc“, k~^] with k~ = {1 — r)k and fc'*' = (1 + r)k for a 
fixed value r. 

In these conditions, we simulate the secret key generation rate R = £/N for a fixed value of the correctness coefficient 
Cc = 10“^®. For this, we perform a numerical optimisation of the resulting secure key rate over the free parameters 
Pz,Pk,,Pkdi,ks and fcdi- 


A. Key generation rate for the exact intensity control case 

The resulting secret key rate for this scenario, i.e. when r = 0, is shown in Fig. [2l The security parameter is 
Csec = 10“^° and the total number of signals sent by Alice is N = 10® with s = 9,10,11 and 12. We consider two 
possible cases: ■C = 0 {i.e., the perfect encoding case) and ^ = 0.147, which is equivalent to a phase modulation error 
of 8.42°. For comparison. Fig. [2]also includes the asymptotic secret key rate {i.e., the key rate in the limit of infinitely 
large keys) with two decoy settings. 
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Fibre length [km] 


FIG. 4: (Colour online) Secret key rate (per pulse) in logarithmic scale vs fibre length when the intensity fiuctuation is 2%. 
The security parameter is Csec = 10“^° and the total number of signals sent by Alice is = lO'* with s = {14, 15} (from left 
to right). The rightmost two lines correspond to the asymptotic secret key rate with two decoy settings. The solid lines denote 
the case ^ = 0 (i.e., the perfect encoding scenario) while the dashed lines show the case ^ = 0.147 (which is equivalent to a 
phase modulation error of 8.42°). The experimental parameters are described in the main text. 



Fibre length [km] 


FIG. 5: (Colour online) Postprocessing block size \Zk^\ vs fibre length for a fixed total number of signals N = lO'* sent by 
Alice, with s = {14,15} when the intensity fluctuation is 2% (from left to right). The solid lines correspond to the case ^=0 
and the dashed lines are for ^=0.147. 


As a result, we find that the effect of state preparation flaws on the key generation rate is almost negligible. Also, 
we have that if the total number of signals sent by Alice is about N = 10^^, Alice and Bob can exchange secret keys 
over 150 km both when ^ = 0 and ■C = Oj 147. 

Finally, Fig.[3]shows the postprocessing block size \ZkJ which is the length of the bit string to be processed in error 
correction and privacy amplification as a function of the distance when N = 10® with s = 9,10,11 and 12. 


B. Key generation rate for the intensity-fluctuation case 

In this section we evaluate the resulting secret key rate when the laser source suffers from intensity fluctuations. 
We study two cases: r = 0.02 and r = 0.05, where r is the deviation rate from the expected value of the intensity. 
The results are shown in Figs. 2] and [51 Here we consider that N = {10^"*^, 10^^}, and the term ^ takes again the values 
^ = 0 and ^ = 0.147. The security parameter is Csec = 10“^° in Fig. 2] and Csec = 10“® in Fig. 21 

For comparison, these two figures also show the asymptotic secret key rate when Alice and Bob use two decoy 
settings. In this asymptotic case, we find that the degradation on the achievable key rate, when compared to the 
scenario r = 0, is only about 10 km (20 km) when r = 0.02 (r = 0.05). 

In the finite-key regime, however, we obtain that the presence of intensity fluctuations seems to strongly limit the 
key generation rate if Alice and Bob do not know their probability distribution but only know the interval where the 
fluctuations lie in. For instance, when N = 10^^ and r = 0 (see Fig. HD Alice and Bob can distribute a secret key 
over more than 100 km. However, to achieve a similar secret key rate performance when the intensity fluctuation of 
the source is 2% (j.e., the parameter r = 0.02) they need to exchange about N = 10^^ signals. The main technical 
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FIG. 6: (Colour online) Secret key rate (per pulse) in logarithmic scale vs fibre length when the intensity fluctuation is 5%. 
The security parameter is Csec = 10“® and the total number of signals sent by Alice is A" = 10“ with s = {14,15} (from left to 
right). The rightmost two lines correspond to the asymptotic secret key rate with two decoy settings. The solid lines denote 
the case ^ = 0 (i.e., the perfect encoding scenario) while the dashed lines show the case ^ = 0.147 (which is equivalent to a 
phase modulation error of 8.42°). The experimental parameters are described in the main text. 



FIG. 7: (Colour online) Postprocessing block size \Zk^\ vs fibre length for a fixed total number of signals N = 10“ sent by 
Alice, with s = {14,15} when the intensity fluctuation is 5% (from left to right). The solid lines correspond to the case ^=0 
and the dashed lines are for ^=0.147. 


reason for this behaviour seems to be the fact that Azuma’s inequality [39| has a relatively slow convergence speed 
when compared to the Chernoff bound 371 and the Multiplicative Chernoff bound [l3| . 

As a side remark, let us mention that when r = 0.05 and N = 10^^ we find that the achievable secret key rate is 
basically zero unless we increase the security parameter Csec from Csec = 10“^*^ to Csec = 10“®. This is illustrated in 
Fig. [51 

Finally, Figs. [5] and [7] show the postprocessing block size \ZkJ as a function of the distance when N = 10® with 
s = {14,15} for the 2% intensity fluctuation case and for the 5% intensity fluctuation case, respectively. 


VI. CONCLUSION 

In summary, we have provided explicit security bounds for the loss-tolerant QKD protocol in the finite-key regime. 
On the application front, our results constitute an important step towards practical QKD with imperfect light sources, 
in that the resulting security performance is robust against encoding inaccuracies like, for instance, optical misalign¬ 
ments. Furthermore, our results take into account intensity fluctuations in the light source, which is a common 
experimental fact. Our results highlight the importance of the stable control of the intensity modulator as well as the 
need for a precise estimation of its intensity, which is not often sufficiently emphasised in the experiments. On a more 
general outlook, it would be of great practical interest to incorporate our results into measurement-device-independent 
QKD (mdiQKD) 
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APPENDIX A: DERIVATION OF THE SECURITY BOUND 


Here we present the calculations for the security bound given by equation ([2|). The security analysis is based on 
the universal composable security framework 28|, l29| . 

Recall that after privacy amplification, the joint state shared by Alice, Bob and Eve is described by the following 
classical-quantum state 


PsaSbE = X] p('5a,sb)|sa,sb)(sa,sb|saSb 


(38) 


where sa and sb are the classical bit strings for the keys, associated with orthonormal states |sa) and |sb) in a 
Hilbert space. Here, p(sa,sb) denotes the distribution of the keys and is the quantum state of Eve’s system 

conditioned on Sa = sa and ^b = sb. In the ideal scenario, the joint state is described by 


p'sIsbE - 


s, S|SaSb ® PE, 


(39) 


where Sa = Sb = s and pE is an arbitrary quantum state held by Eve. Using the security definition stated in the 
main text, a Cgec-secure QKD protocol satisfies 


1 


I actual ideal 11 ^ 

IuSa^bE uSa^bEIIi — ^sec- 


(40) 


Furthermore, if the security parameter Csec is appropriately chosen, it can be seen as the sum of errors in the correctness 
and secrecy, i.e., Csec = Cs -I- Cc. To see this, let us introduce an intermediate state. 


P'sTsaE — y]]p(sA)|sA, Sa){sa, SaIsaSa G Pe"^ , 


(41) 


which is just a trivial classical extension of Alice’s state. Then, by using the triangle inequality property of the trace 
distance metric, we have 


^ II actual ideal || ^ ^ || actual inter || i || inter ideal || 

9 IIPSaSbE PSaSbEIIi ^ 9 ||PSaSbE PSaSaEIIi + 9 IIPSaSaE PSaSbEIIi ■ 


2 lirOAOBtt '^JAJBttlll — 2 

Fixing the first term on the R.H.S to Cc gives 


ec = i WpTsbB - P‘sa5ae|L > ^ IIpS - PsIsaIIi = P^l^A ^ ^b], 


where the inequality is due to the fact that the trace distance metric is contractive under any trace-preserving operation 
(in our case, the partial trace operation). Similarly, by fixing the second term to Cg we have 


_ ^ II inter ideal || ^ || inter ideal || 

*^3—2 \\PSaSaE ~ PSaSbEIIi ^ 2 H^SaE ~ PSaE 111 ■ 


Therefore, fixing Cgec = Cs + Cc gives the desired decomposition. 
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From 


the lower bound on the secret key length of our protocol is written as 

2 


> 


mp + m\[l - r] - Aec - log 2 — I, 

6r J 


(42) 


where mg and m\ are the lower bounds on the detection events of the vacuum and the single-photon emission, 
respectively, and m\r = m^(/i(epjj) +6) is the number of rounds performing the random hashing to correct the phase 
error, which is equivalent to the number of bits sacrificed in the privacy amplihcation step of the protocol. The 
parameter Aec denotes the number of bits consumed in bit error correction, and [log 2 l/ed < log 2 2/ec is the length 
of the hash that Alice sends to Bob for the error verification using the universal 2 hash functions. From Q and 36|, we 

have that Cg can be bounded by Cg < — (1 — ri){l — 2“”^i^+^) < \/rj + Therefore, the secret key length 

is obtained as 


i> 


TOo+”^i[l-h(eUh)]-log2 


Cg -?7 


- Aec - log2 — 


(43) 


where we consider ry as a fixed value in this paper. 


APPENDIX B: TECHNICAL LEMMAS 

In this Appendix we introduce four different concentration inequalities which are used throughout this paper. 
First, we introduce the stochastic model that is assumed in Lemmas 1, 2 and 3. 

Stochastic model in Lemmas 1, 2 and 3. 

Let Ai,A 2 ...,Ajv be a set of independent Bernoulli random variables that satisfy P(Ai = 1) = pi, and let 
X := The expected value of X is denoted as p := E[X\ = observed outcome of X is 

represented as x. 

Lemma 1. Chernoff bound 

This bound requires the knowledge of p. It relates x with /i as 

x = p + Sg, (44) 

except with error probability ec -I- eci where the fluctuation term Sc lies in the interval Sc G [~Ac, Ac] with 
Ac = gcifJ-Xc) and Ac = gcigxc)^ where gc{x^y) = ^/2x^\x^\Jy and gc{x^y) = -^/Sxlnl/y. Here the parameter 
ec (ec) denotes the probability that x < p — Ac {x > p + Ac). Equation (l44l) holds if both 0 < gci^/p, ec) < 1 and 
0 < gc{i/p, ec) < I are met. 

Lemma 2. Hoeffding bound 

This bound does not require the knowledge oi p. It relates p and x as 

p = x + Sn, (45) 

except with error probability en + en, where the fluctuation term (5h lies in the interval (5h G [—Ah, Ah] with 
Ah = 5 h(A, ch) and Ah = 5 h(A, eh), and where gn{x, y) = yjx/2\nl/y. 

Lemma 3. Multiplicative Chernoff bound [H 

This bound does not require the knowledge of p. It combines Lemma 1 and 2 above. It uses Lemma 2 to estimate a 
lower bound on p that is then basically used in combination with Lemma 1. In particular, let pc = x — y^A"/21nI/eH 
for certain ch > 0. Then, if the following two conditions are satisfied: < exp(9/32) and < exp(I/3) 

with Cm, Cm > 0, this Lemma states that p and x can be related as 

P = x + Sm, (46) 

except with error probability en + cm + cm, where 5 m lies in the interval [—Am, Am] with Am = gM{x, e^/I6) and 
Am = gmix, em^^^), and where 5 m( a;, y) = ^/2x\n(y^. 
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Lemma 4- Azuma’s inequality 

This result plays a crucial role in our security analysis. It is applicable to any stochastic model as long as the 
Martingale and the Bounded difference conditions (BDC) are satisfied. In particular, a sequence of random variables 
... is called a Martingale if and only if for all non-negative integer 

I, where E[-] represents the expectation value. On the other hand, ... is said to fulfil the BDC if there 

exists > 0 such that for all non-negative integer 1. 

Let us consider N trials of a random variable X^’'\ where I refers to the ffh trial. If is a Martingale and satisfies 
the BDC with = 1 then Azuma’s inequality guarantees that 


Pr[|AW - > N6] < 2e"^ 


for any <5 € (0,1). 

Let us now define the following random variable for the Ith trial, 

i 

XO) :=A«-^P(u|Co,...,e«-i), 

U—1 


(47) 


(48) 


where A^^^ represents the actual number of events of the form X^'’'> = I observed among the first I trials, and 
P{u\^o, ...,^„_i) is the conditional probability of having the event “I” in the nth trial conditioned on the first n — I 
outcomes ^Oj ■ ■ ■ la this scenario, it is straightforward to show that the random variables given by equation 

(l48l) are Martingale and satisfy the BDC with = I. Hence, by applying Azuma’s inequality we have that 


Pr[|AW - £ P(n|eo, C^-i)! > N6] < 26“^. 

U—1 


(49) 


This means, in particular, that 


N 

AW =^P(n|^o,...,^«-i) + 5A (50) 

li —1 

except with error probability ca+ca, where the parameter i5a lies in the interval Sa G [—Aa, Aa] with Aa = <7a(A^, ca) 
and Aa = 5a(A^, ca), and where 5 a( a;, y) = \/2)rIn(T7^. 


APPENDIX C: DECOY-STATE ANALYSIS 

In this Appendix we first present the detail of the decoy-state analysis for the intensity fluctuation case and then 
we summarise all the equations for the decoy-state analysis, including those for the exact intensity control case. More 
precisely, we describe the estimation procedure that we use in order to obtain a lower bound on the number of vacuum 
contributions Tz^, and both a lower and an upper bound on the number of single-photon contributions Tz.i- 


1. Intensity fluctuation case 

Here, we generalise the decoy-state method to cover the case where the source suffers from intensity fluctuations. 
For this, as already mentioned previously, we shall consider that Alice and Bob only know the interval [k~, k~^] where 
the intensity k lies. 

We begin by calculating the mean value {Zk). Our starting point is the random variable for the ith trial 

when both Alice and Bob select the Z basis. This random variable takes the value I if Alice chooses the intensity k 

and, moreover, the generated signal is detected by Bob; otherwise it is 0. The term * — i reflects the fact that 
may depend on all the previous i — 1 trials. With this notation, (Zk) can be expressed as 

2 = 1 2 = 1 


{k A det|Z), 


(51) 
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where Nz is the number of events where both Alice and Bob select the Z basis. The probability (*) denotes the 

conditional probability that the event * occurs in the ith trial conditioned on the results obtained in the previous i — 1 
trials, and the term k A det\Z represents the event where Alice selects the intensity k and Bob detects the generated 
signal given that both of them have chosen the Z basis. By using Bayes rule, we can rewrite equation (15111 as 

Nz OO _^ 

{Zk) = Pk EE A detjfc A Z) 

z —1 n—0 

^ Nz OO _^ 

= — ^ ^ p(d»-i) (fc A Z A n A det) 

i—1 n—0 

= ;^EE A Z A ^(det|A: A Z A n) 

i=l n=0 

OO 

= Pk EE^^ *)(n|fcAZ)p(*l*^)(det|ZAn), 

n—0 

where pk is the probability that Alice chooses the intensity fc; n denotes an n-photon signal; Pz represents the 
probability of selecting the Z basis; and is the probability that the event * occurs in the ith trial. For 

instance, p^'^\n\k A Z) is the conditional probability that Alice emits an n-photon state in the zth trial given that 
she has chosen the intensity k and both Alice and Bob have selected the Z basis in the *th trial. Note that in 
the transformation from equation (|54)) to equation (l55)l we have used the property of the decoy-state method i.e., 
p(*l®“^)(det|fc A Z An) = p(*l®“^)(det|2' A n). 

In so doing, we obtain that (Zk) is upper bounded by 

(Zk) < Pk EE^E^^ -p^^''^\det\Z An). (56) 

i=i n=o 


(52) 

(53) 

(54) 

(55) 


Similarly, we find that 


{Zk) >Pk'^Yl 


-{k-y 


■p(*l*-^)(det|ZAn). 


(57) 


i —1 n—0 


Lower bound on the number of vacuum contributions 

To obtain this bound, we first rewrite equations (1561) and (1571) for the cases k = fcd 2 and k = k^n, respectively. We 
obtain the following two inequalities. 


e^d2 


Pkd2 


{Zkd2) < £p(*l"^Hdet|0 A Z) + gp(*l*^)(det|l A Z)fc+ + g ^p(*l*^)(det|n A Z) 




(58) 


2=1 


2=1 


2=1 n>2 


e 

P^di 


i _ —i (U- \n 

{Zkdd) > E p(*l*^)(det|0 AZ) + ^p(*l*^)(det|l A Z)fc- + EE p(*l*^)(det|nAZ)A-dl^, (59) 


2=1 


2=1 


2=1 n>2 


Next, we multiply equation (l58l) by k^.^ and equation (l59l) by k^^, and we add both expressions. In so doing, we find 
that 




iNi - k+,)Y,p^^\^^\det \0 AZ)> hd^iZk^y - 


2=1 


Pkd2 


Nz 


^dl^d2 E E 


Pkdi 


2=1 n>2 


k'~ 

e^d2 


n\ 


e^di 


p^*l*-^^(det|nAZ) 


— ^dl {Zkd2) ^d2„ {Zkdi)i 


Pkd 


Pkd 


(60) 
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where the second inequality holds because > k'^ 2 - 
As a result, we find that Tz^ is lower bounded by 

Tz.o := ^p(*l*^)(det|0 A Z) > —-- fc+(61) 

7^1 hi - h2 ^ PkA2 Pfedi ^ 

To estimate the expectation values (Zk^^) and {Zk^.^-, we use Azuma’s inequality because each trial of the random 
variables depend on the previous ones. 


Lower bound on the number of single-photon contributions 

Here, we first particularise equations (IMl) and (1571) for the cases k = fcdi and k = fcd 2 , respectively. We have that 


e^'di 

Pkdi 


{Zkdd) < £p(*l*^)(det|0 A Z) + gp(*l*^)(det|l A Z)(fc+) + ^ gp(*l*^)(det|n A Z) 


(ki,) 


(62) 


2=1 


2=1 


l >2 2=1 


fe+ ^ jVz _ , 

^— {Zkd^) > A Z) + ^p(*l*'^)(det|l A Z)(fcj2) + A Z) 

P^d2 


(^d2) 


'1>2 i=l 


Next, we add both expressions and we obtain 


e^'d2 

Pkd2 


>- —(Zfc^j) + i)(det|lAZ)(A:^2) + XlX!^^*'* ^Hdet|nAZ) 


(Zkd.) + A Z)(k+) + ^ £pW*^)(det|n A Z)^ 


2=1 

iv^ 


n>2 2=1 


hiT 

nl 


{k 


A2r 


Pkdi 




n>2 2=1 


This last equation can be rewritten as 

Pkdi 


(‘Ji - tJd A Z) > ^(Z.„) - i^(Z.,.) + ^ ^ Z) fe)"-^.) 

rii^. Pkd2 ^ 


2 = 1 


- 1>2 2=1 


\n _ fi.-\- \n 

nl 


Next, we evaluate the third term on the R.H.S of equation f|65p . This term is lower bounded by 


^X;p(*l*^)(det|nAZ)^S^i^ > (fed'2)'3 ^^pbK-^)(det|nAZ)ffi 

n>2 i=l ) n>2 i=l 


(63) 


(64) 


(65) 


( 66 ) 


because when the conditions n > 2, k^^ > k^^ + ^d 2 satisfied we have that (fcjj 2 )" — (^di)" > 

[(^d 2 )^ ~ ikdi)‘^]ikrh~‘^■ If we now use equation (l57ll for k = fcg, we have that 

N, . /,_s„ ^fc+ Nz 

Pk, 


^£pCI«>(de.|„AZ)<S < ^(Z..) - £ (p(*l*'^)(det|0 A Z) + /c-p(*l*'^)(det|l A Z)] . (67) 

n>2 i=l P^‘ i=l ^ 


n>2 2=1 


The R.H.S of equation (1551) can be lower bounded using the R.H.S of equation (1571) . This is so because > k^^ 
therefore the term [{k^^^)'^ ~ (qi)^]/(^s”)^ < 0 in equation (1551) . Hence, we have that the third term on the R.H.S of 
equation (1551) is lower bounded by 


^ ^ (det|n A Z) 

n>2i=l 


> 


(fcd2)^ - (^dl) 

ikrr 


2 r^k+ 


'-Pk, 


-{ZkJ 


N. 

- (^^*'"^^(^16110 A Z) + A:,V*l*^)(det|l A Z)) 

2 = 1 


( 68 ) 
















18 


That is, if we now combine equations (1651) and (1681) we find that 

Ks J ^ Pfcdl Pfcd2 


yi Pkd2 

,+ \2 '.-'T 1.+ 


which directly gives us a lower bound on Tz^i, 




( 69 ) 


N. 


Tzn : = ^p(*l*-^)(det|lAZ) 

i=l 


> 




n„fc. 


(fcd\ - fcd"2)(^^- - - ^d-2) Lpfcai Pfed2 


e«di _ ^ e''d2 _ . (fc+)2 - (fc^^)2 /efc+ 

'^Pfca 


ri Q-i rt 


(fcs-)2 


(^fea)-r|,o)]- (70) 


Upper bound on the number of single-photon eontributions 
By adding equations (l58)) and (l5^ . we have that 


(tj. - A Z) < ‘—(Z,.,) - ‘—(Z,,,) + j;|(pClrt)(det|„ A Z)®-^ 

i=l Pfcd2 „>2 i=l ”■ 


e^'di 

<—{Zk,,) - {Z,,,), 

Pkdi Pkd2 


(71) 


where the second inequality holds because > k'^^- This 

N 
t^Z 


hi ^ ^d 2 - This means, in particular, that Tzp is upper bounded by 
,fct 


Tz 1 = ^pW*^)(det|l A Z) < [ + ( — {Zkdd) - —{Zk. 

^ril ^d2 ^Pkdi Pkd2 


(72) 


2. Summary of the decoy-state analysis 


Here, we summarise all the equations needed in the decoy-state method, including those for the exact intensity 
control case. 


Lower hound on the number of vaeuum contributions 

Let Decoy^{ay, by') denote a lower bound on the number of events where Alice generates a vacuum state using the 
signal intensity and the basis setting a G {Z,X} to encode a bit value y G {0,1}, and Bob observes the bit value 
y' G {0,1} when he measures the received signal using the basis b G {Z, X}. 


Decoyo{ay, by') 


p {ks A 0) 

Jc~ — 

^dl ^d2 




Pkdi 



(73) 


where the parameters {a^b^ f.^^) and {a^b^ are defined in a similar way like equations (O and (fTUl) for the exact 
intensity control case and like equations (EOl) and m for the intensity-fluctuation case, respectively. The probability 
p~ {ks A 0) is a lower bound on p{ks A 0) which denotes the probability that Alice selects the signal intensity setting 
and sends a vacuum state. 


Lower bound on the number of single-photon contributions 

Let Decoyi{ay, by') denote a lower bound on the number of events where Alice prepares a single-photon state using 
the signal intensity and the basis setting a G {Z,X} to encode a bit value y G {0,1}, and Bob observes the bit value 
y' G {0,1} when he measures the received signal using the basis h G {Z,X}. 


Decoy ^ {ay,by') = ^^ 

(^dl ^d2)(^s ^dl ^d2) ^Pkdl Pkd2 

^ (fcdi)^ - (^^2)^ / Decoyoiay, by') _ 




{ks )2 V p {ks A 0) 


( 74 ) 
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where the probability p (/cg A 1) is a lower bound on p{ks A 1) which denotes the probability that Alice selects the 
signal intensity setting and sends a single-photon state. 


Upper bound on the number of single-photon eontributions 

Let Decoy]^(a 2 /, by') denote an upper bound on the number of events where Alice prepares a single-photon state using 
the signal intensity and the basis setting a G {Z,X} to encode a bit value y G {0,1}, and Bob observes the bit value 
y' G {0,1} when he measures the received signal using the basis b G {Z,X}. 


Decoy 1 (ay, &y') 


p+(fcs A 1 ) fe^i^ ! 

7.- 7.-I- I „ V 




^Pkdi 





(75) 


where the probability p'^{ks A 1) is an upper bound on p{ks A 1). 


APPENDIX D: PHASE ERROR RATE ESTIMATION 


In this Appendix we explain how to derive equation (1361) . That is, we obtain an upper bound on the number of 
phase errors associated to the single-photon pulses emitted by Alice when she selects the signal intensity setting, both 
Alice and Bob use the Z basis, and Bob obtains a successful detection event (ie., y' ^ 0). As we are interested in the 
phase error rate defined in the single-photon emission events and all the statistics associated with the single-photons 
can be estimated using the decoy state method, in the virtual protocol we only consider the cases where Alice emits 
single photons. 

For this, in the security proof we consider a virtual protocol that based on the complementarity argument 
is equivalent to the actual protocol. In the virtual scheme, Alice prepares an ancilla qubit which is entangled with 
the pulse that she sends to Bob. Importantly, from Eve’s viewpoint both protocols are completely indistinguishable 
because they emit the same quantum states and announce the same classical information. 

Let us start our analysis by introducing the following joint states, which we shall denote as They are a 

purification of the signals with j G {0,1} (see equation (15^ 1. 


= v/Po^"|0)Ai|<?io")B + t/Df |l)Ai|(/>f )b, 


(76) 


where the index Ai represents the ancilla system and the index B is the system that Alice sends to Bob. In addition, 
we define the state: 


|^z)Ai.A2,B = -^(|0)a2|V’O,)Ai.B + |1)a2|'0iJai.b), 


(77) 


where the ancilla system A 2 stores the bit information. The aim of the virtual protocol is to quantify how accurately 
Bob can estimate Alice’s measurement outcome if she would measure system A 2 in the complementarity basis (ie., 
if she would use the POVM Mx,A 2 = {|+)(+l 7 1~)(~|}7 where |±) = l/-\/2(|0) ± |1))). This way one can characterise 
the information that Eve could have obtained about the raw key [Hj . Note that equation (l77)) can be rewritten as 


1,7, \ , / 1 + ('0oJ'01.)Ai.B I , ^ I 7vir\ , , / 1 - ('*AoJ^1.)Ai,B I ^ , 7vir\ 

IVDA 1 .A 2 .B = Y-^-I+)a2IV’oJAi,b + Y-^-|-)a2|ViJai,b, 

where the normalised virtual states |^^™)ai,b, with j G {0,1}, are defined as 

IV'oJai.b + (-1)'^|'0u)ai.b 




2[l -h (-1 )^'(V'oJ^iJai,b] 


(78) 


(79) 


Let us now introduce some additional notation before we describe in detail the different steps of the virtual protocol. 
In particular, the states prepared by Alice in the virtual protocol are given by 

5 

= X! -P(c)|c)sh|<^^°^)Ai,B, 

C=1 


|<(>)sh.Ai.B 


(80) 
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where the shield system sh belongs to Alice’s laboratory, the states have the form 

|</>^^^)Ai,B = |V'™)ai,B, 

|</>^^^)ai,B = |^0^)ai,B, 

|<^^^^)Ai,B = |^1,)Ai,B, 

|</'^®^)Ai,B = |'!A0x)Ai,B, 


(81) 


and the probabilities P{c) are given by 

P(1) = ^(i + (^oJ^i.)a,.b), 

P(2) = ^ (l - (^oJ^iJa,.b) , 

P(3)=P(4) = ^, 

P{5)=p^. (82) 

Also, we define Bob’s POVM for the Z and the X basis measurement as Mz^b = {XIzo, Mzi, Xlzf} and Mx,b = 
{Mxo, XIxi, Xlxf}, respectively. Here, the operator Mz{x)t corresponds to the inconclusive outcome in the Z (A) 
basis. Importantly, in the security analysis we assume that this operator is the same for both basis, he., Mf := 
Mzf = Mxf- This assumption allows us to conceptually delay Bob’s measurement basis choice until he is certain to 
obtain a conclusive result. That is, we can consider that Bob first conducts a filter operation with Kraus operators 
D = {\/I — Mf, y/M{} followed by the Z or X basis measurement, which we redefine as {Mzo, Mzi} and {Mxo, Mxi}, 
respectively. 

Next we present the steps of the virtual protocol in detail. 


Virtual protocol 

Alice repeats the first step ni times, where ni is the number of single-photon emissions generated by Alice in the 
actual protocol within the set \ZkJ- 

1. Preparation 

Alice prepares the state |(/))sh,Ai,B given by equation (l80)) . Afterwards, she sends Bob system B over a quantum 
channel and delays her measurement on system sh until step 3. 

2. Filter operation 

Bob performs on system B the filter operation D and, if this operation succeeds, he stores this system in a quantum 
memory. We will denote the set of successful filter results as S, and |S| = Ni. 

3. Collective measurement 

Alice and Bob perform on the states in the set S a collective measurement characterised by the POVM elements 
Fq.,s, with O € {1, 2,..., 6} and s € {0,1} (see equation (1551) 1 on the states in the set S. 

4. Classical communication 

Alice announces the Z (A) basis choice over an authenticated public channel when the result of her measurement 
in step 3 is = 1, 2, 3,4 (H = 5,6). Then, Bob announces the Z (A) basis choice, also over an authenticated 
public channel, when the measurement outcome in step 3 is = 1,2,6 (O = 3,4,5) to ensure that the classical 
information declared in both the actual and the virtual protocols coincide (see the main text below for further 
details). In addition. Bob declares the value of s when H = 3,4,5, 6. 


5. Estimation of the number of phase errors 

Alice and Bob calculate an upper bound on the number of phase errors. This upper bound is given by 


A. 


u 


ph 


= a(-^) + a: 


(Ai) 

2.0 ’ 


(83) 
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where denotes the number of outcomes associated to the operator after Ni trials, and is an upper 

bound on 


The size of the set S (see step 2 of the virtual protocol) is upper bounded by 

= E E Decoyi(a2/,&?/'), ( 84 ) 

a,b£{Z,X} y,y'e{0,l} 


where the parameter Decoyi(aj/, 6y') is defined in Appendix C. Also, the POVM elements Ah,s of Alice and Bob’s 
collective measurement are given by 


Pn,s = -P[|f^)sh] ® Mxs when e {1, 2, 3,4}, 

As.s = -P[|5)sh] ®PxMxs, 

F^,s=P[\^)sb\®PzMzs. (85) 

These POVM elements satisfy SnG{i....,6} = -^sh O /b- 

It is easy to demonstrate that from Eve’s viewpoint the virtual protocol described above is completely equivalent 
to the actual protocol. Indeed, the quantum states that Alice sends to Bob are exactly the same in both protocols. 
Also, both schemes declare precisely the same classical information. To see this last point, let us further clarify the 
fourth step of the virtual protocol. In particular, note that when 17 = 1(2) the state that Alice sends to Bob in the 
virtual protocol is TrAiT’[|'!/'o(i)a:)AiB] and Bob uses the X basis. However, in this case, Alice and Bob announce the Z 
basis. In so doing, the actual and virtual protocols are indistinguishable. This is so because in the actual protocol the 
events H = 1 or 2 are used to generate a secret key, i.e., in these events both Alice and Bob select, and therefore also 
declare, the Z basis. Then, the virtual protocol has to do the same declaration, otherwise it could be distinguished 
from the actual protocol. That is, with our definition of the virtual protocol we guarantee that it produces precisely 
the same classical information as the actual protocol. 

Next, we present the estimation method that we use in order to upper bound the quantities A^^^^ and using 

experimentally observed values. For this, we consider the sequence of random variables Xq\, with I = 1,..., Ni, given 
by 


I 

- E P^Anl^o, ...,^«-i), (86) 

U—1 

where Pn_s(it|^ 0 i •■■i'?«-i) is the conditional probability of obtaining the values and s in the collective measurement 
performed in the uth trial of the third step of the virtual protocol, conditioned on the first u—1 measurement outcomes 
from the collective measurements To obtain this conditional probability we use the following joint state 

in Ni trials. 


|^')sh,Ai,B = |«!>^)sh,Ai,B|<(>«)sh,Ai.B|^]^^)sh,Ai,B, (87) 

where |</>^^)sh,Ai,B, |^f>«)sh,Ai,B, and _.^ )sh,Ai,B represent, respectively, Alice’s prepared states in the first u—1 
trials, in the uth trial, and in the rest of trials. 

Let [/be denote Eve’s unitary transformation on Bob’s system B and on her system E. We have that 

C/BE|4>)sh,Ai,B|0)E = E-®*T|4’)sh,Ai,B|[)E, (88) 

t 

where b denotes the Kraus operator which acts on system B depending on Eve’s measurement outcome of her 
ancilla. Now we consider Alice and Bob’s collective measurement. In particular, let Msh„,s„ represent the Kraus 
operator associated with the uth (1 < u < u) measurement outcome of Alice’s system sh and Bob’s system. Also, let 
C*ii-i,sh,B denote Alice and Bob’s joint measurement operator up to u — 1 trials. It can be written as 

U—1 

Ou-l,sh,B = Afsh„,s„(/sh ® \/l — Mf). 

v—1 


( 89 ) 
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We shall denote the measurement outcomes of the first u — 1 trials as Ou-i- Then, after Eve’s intervention and 
conditioned on the fact of obtaining the measurement results Ou-i, we have that the normalised uth state of Alice’s 


system sh and Bob’s system B, which we shall represent as is given by 


where the state has the form 

u\Ou-l 


sh,B 


sh,B 

^ I-1 

u\u — l 


\u—l 
sh,B 




(90) 


Tra ^P[C’M-l,sh,B^t,B|‘h)sh,Ai,B]) ■ 


(91) 


Here, Tr^ is the trace over all systems except for the rtth systems sh and B. Equation (pTI) can be rewritten as follows: 


sh 

^u|0. 


0„_1 Tr^^^ (^P[{u - i|(fVl - u|C>„_i,sh,BHt_B|^^)sh,Ai,B|^«)sh.Ai,B|0]vr^)sh.Ai,B]) 


u—l,Ni—u 




(92) 


u—l,Ni — u 


where Tr^^^ represents the trace over the uth Ai system, the states |m — i) and |fVi — u) denote an orthogonal basis 
for the first u — 1 systems and the last Ni — u systems, respectively, and 


■= (m - - u|0„_i,sh,BHt,B|()'^)sh,Ai.B|(/>]^^)sh,Ai,B 

is the Kraus operator acting on the itth system conditioned on the measurement outcomes Om_i. 

Therefore, we obtain that the conditional probability defined in equation (1551) for G {1, ...,6} is given by 


(93) 


■•■,^a-l) = Tr < Fq^s 




Tr 




Q(n) 


Tr 


f*/ ^sh,B 
u\u—l 


-Tr 


=: Q(r!)T^I^) fTrA,P[|(^(''))A,.B] 


^^„p)Tr^^p[|^(0))A^B] 


(94) 


where £{p) := (/sh 0 y/I — Mf)p{Ish 0 y/I — Mf)\ the probability Q)^) = P{^) for fl G {1,2, 3,4}, Q{5) = PxP{5) 
and g(6) = PzP(5), the operator := MxsiVI - M{ the 

states |^^^^)ai,b are defined in equation (I5T|) . and TrAi/’[|^^^^)Ai,B] is the wth conditional probability that 

Bob’s measurement outcome in the X basis is s € (0,1} given that Alice sends him the state TrAi/’[|^*-*^^)Ai,B] and 
the filter operation succeeds conditioned on the first u — 1 measurement results. For convenience, we shall refer to 

Tmxs”^^ [A] as the transmission rate of A. 

If we now apply Azuma’s inequality (see Lemma 4 in Appendix B), we obtain 


Ni 


^Pn,.(u|eo,...,e«-i)-A[,y^) 




(95) 


except with error probability o, where q = gx^Ni, c^q). 

By combining this result with that from equation (I94p . we have that 


A(^i)_As Ni _ 

^'-n,s ^A,n ^ rp(ix|«- 

W) - 


Tta,P0^^}a,,b] 


< 


A, 


(Ni) 


A' 


A,a 


Q{n) 


(96) 
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Note that the parameters with f2 G {3,4,5}, can be upper and lower bounded using the decoy-state method. 

We shall denote the failure probability of this estimation as ezo,Xs, £zi,Xs and exo,Xs, respectively. 

As a result, we obtain bounds on TrAi^’[|(/>^^^)Ai,B] that maximise the number of phase errors iVph 

in the single-photon emissions within the set \ZkJi. They are denoted as NmxA^) have the form 


N. 


Mx. 


,(3) :={ 


Decoy ;^(2'0, Xs) — Decoyi(2'0, Xs) + A\ 


Q(3) 


or 


Q(3) 




(97) 


A, 


Mx. 


rDecoyi(Zl, As) - A^4 Decoyi(Zl, As) -h A^ 4 

I 0(41- ” -OMi- '-)• 


(98) 


A, 


MX: 


(5) :={ 


Deco^(AO,As)-A^ 5 Decoyi(AO, As) + A^ ^ 


Q(5) 


or 


Q(5) 


}■ 


(99) 


When Q G {1,2}, the quantity ’ with s G {0,1}, represents the transmission rate of the virtual 

states p™ = TrB(T‘[|'0™)Ai,B]), with |'0 ™)ai,b given by equation (17^ . This quantity can be decomposed into the 
transmission rate of the Pauli operators (Ji,ax and az- However, for later convenience, we will decompose it as a 
function of poz and piz, together with ai,ax and az- Here, the states poz and piz are defined in equation In 

particular, from equation (l7^ we find that 


T 


{u\u— 

Mxs^l 


2[l + (-l)^(^„ 1^4 b] + T^Sipiz] + (-I)^(tS [TrB(P[|^oJ(^ijA,.B]) 

TrB(P[|^lJ(V)oz|Ai.B]) ) I 


n(it|n— 

-^xse 


rp{u\u-l)r^ 1 _L 1 

Mxs©i Mxsffii 


{u\u — 


2{1 + {4>l^\4,l^) + v^7l^(0?1<(>}^))} L 

+ (-1)^ ^ [az] + [ax] 

(„0z Iz 7 Oztlz'irp(MD—i) r 1 

+ (a* a* -Ot Ot )^Mxsmi\-^^\ ’ 


( 100 ) 


where we have used equation (1761) in the second equality and see equation (1351) for the definition of of and . 

In addition, we have that the transmission rate of poz, piz and pox can be decomposed using the Pauli operators as 
follows 




’[PO.] \ 
rT^(^l^)r~ 1 

VTS[pox]y 

Hence, the transmission rate of the Pauli operators can be described as 



TS£2>k,i ( 


tSIA.’Io/I ) 

TSlA’kzl 

=: A 

bS’i-'-i 





( 




[<^/] \ 


Mx 

TiSVxl 

T‘S>[.z| / 


TSS>l,io.l \ 


= A 


-1 


^M xsmx 

V TM{,^{^y[pox] j 


( 101 ) 


( 102 ) 


where the inverse matrix A ^ is given in equation (1371) . 
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Now, if we combine equations (llOOl) . (11021) and (I%1) . we obtain that TVph is upper bounded by 

1 Ni 

iVph = +AiZ^ < E +1) E 


E 


rT^(u|u-i) 
Mxs^l 

U — 1 

P{s + 1) 


As@l 
' ^A,s+1 


Ni _, J\i _, 

i:T£Sfci+i:TSS[«.i 

_U—1 U=1 

+ A1®E- (103) 


Ni 


u=l 


2{i+ 

1 ,- ^ Nr Nr Nr 

+ (-1)' E v^w{o,c E TSS’[m-i+c<.i E TSSi«J+c.,2 E 

t—0 u—1 u—1 

Finally, by using the results given by equations (IWll - dMll . we find that 


iVph< E 


P(s + 1) 




Nm.M + Nm,M 


(-1)^ E \/pF^^{Ct,oNM., (3) + Cm Am., (4) + C^Am., (5)} 


t=o 


I A sei 
+ ^A,s+l 


=• aH, 

except with error probability 


Eph — ei,! + ^A,2 + E + E (ezO.As + £Zl,Xs + fAO.As), 

se{o,i},ae{3.4,5} se{o,i} 


(104) 

(105) 


(106) 


where e^.o is the failure probability that equation (IMI) does not hold for fl G {1,..., 5} and s G {0,1}. Also, €zo{i),Xs 
and exQ,Xs the failure probabilities of the decoy state method i.e., the failure probabilities of the estimation of 
A^Z s ^’^'1 respectively. 


APPENDIX E: SIMULATION 


In this Appendix we present the calculations used to obtain Figs. [2114] and [6] in the main text. 

In particular, we consider that Alice sends Bob pairs of coherent states of the form 
and we set Alice’s (Bob’s) phase modulation error to A9a = (Ab = — Aa). Also, we assume a Gaussian 

distribution for the intensity fluctuations of the laser within an interval [k~,k~^]. That is, we consider that the 
probability density function of the fluctuations is given by pcik) = Aexp[—(fe — pY/2a^], where p is the desired 
value {e.g.^ ks,kdi^ and fcd 2 ), the dispersion has the form = r/r/5, and the normalisation factor A is such that 

Ik~ PG{k)dk = I. 


Calculation of the parameters tUq and m\ 

For this, we need to obtain \Zk\ for all k G K. Afterwards, we simply apply the procedure described in section IV.A 
(for the exact intensity control case) and in section IV.B (for the intensity fluctuation case). 

We consider that the total number of pulses sent by Alice using the intensity setting k is given by Afc = Npk, 
where A denotes the total number of transmissions until the conditions in the Sifting step of the protocol are met. 
The total system loss psy ■= ??det?7ch includes the channel loss and the detection efficiency of Bob’s detectors. The 
conditional probability p^'^^ZjlZi) that Bob obtains the bit j G {0,1} using the Z basis given that Alice sends him 
a bit i encoded with the intensity k and also in the Z basis can be written as 


pW(Z0|Z0)= / pG(fc)fl-(l-pd)e-''-" 


dfc, 


pW(Zl|Z0)=pd, 

P^'"\Zj\Zl) = J pG{k) 1 - (I -Pd)exp - (^ 1) cos^ ^ 


dk. 


(107) 

(108) 
(109) 
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The conditional probability p^^\Zj A Zj 0 IjZi) that Bob interprets the bit value j (after a random assignment of 
double click events to single clicks events) when he uses the Z basis given that Alice sends him a pulse with the 
intensity k, prepared in the Z basis, and encoding the bit value i is written as 

A 0 l\Zi)) 0 0 l\Zi). (110) 

To simulate the misalignment in the optical system we transform this probability as 

pW(Zj A WT|Zj) =pW(Zj A WT|^j)(l - emis), (111) 

(Zj 0 1 A ^|Zj) = {Zj A Zj0T|Zj)e^is 0 {Zj 0 1 A MZj). (112) 


In so doing, we obtain 


\Zk\=Nkpl Y. ^Z3®l\Zl). 


The bit error rate in the Z basis when Alice sends Bob a pulse using the signal intensity is given by 


ez = 


E..,e{o,i}^('==H^jA^j0l|Z*)- 


(113) 


(114) 


Calculation of the parameter TVph 

According to equation ((36ll . we have that A’ph is upper bounded by 


Nph <- 


1 — sin i 


^ (Decoyi (XO, Al) 0 Ai^g) 0 ^ (Decoyi (ZO, AO) 0 Decoyi(Zl, AO) 0 + Aa, 4 ) 

Px 

(Decoyi (AO, AO) + 5 ) 0 Aa.i 0 Aa. 2 . (115) 


'-Px' 

I 


1 -sin| 

^Px 


To obtain Decoyi (AO, Al) Decoyi (AO, AO) Hi's! calculate the probability p^^\Xj A Xj 0 1|A0) that Bob 
obtains the bit j with the A basis given that Alice sends him a pulse of intensity k using the A basis and encoding 
the bit value 0. For this, we have that 


pW(Aj|A 0 ) = pG{k) [1 - exp[-^AMi±0!^](i _ p^) 


dk. 


(116) 


Then, by using equation (IllOl) we find 


p^’^HXj A Xj 0 1|A0) = p('=)(Aj|A0)(l - p’-^HXj 0 1|A0)) 0 ipW(A0|A0)pW(Al|A0). (117) 

Finally, we include the effect of the misalignment in the optical systems. That is, we transform p^^'> {Xj A Xj 0 l|Ai) 
as 


P('=)(A0 A A1|A0) = p('=^(A0A A1|A0)(1 - Cmis), (118) 

(A1 A A0| AO) = (AO A AT| A0)emis + (A1 A A0| AO). (119) 


The number |A^| is therefore given by 

\Xi\ = NkplP^'^HXj AXJWT\X0). 


( 120 ) 


Next, we calculate Decoyi(Z0, AO) and Decoyi(Zl, AO). Hiis we need to obtain |Z®A^|. We have that the 

probability (Aj IZi) that Bob obtains the bit j with the A basis given that Alice sends him a pulse of intensity k, 
prepared in the Z basis, and encoding the bit value i is given by 


p«(Aj|Z0)=/ pG{k) 
Jk- 

.k+ 

pW(Aj|Zl)=/ pG{k) 


1 - exp (1 _ „■! 


dk, 

dk. 


( 121 ) 

( 122 ) 
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In this scenario the probability P^^\Xj A Xj © l\Zi) has the form 

P^’^HXjAXjm\Zi)=p^’^\Xj\Zi)il-p^>^HXj(Bl\Zi)) + ^p^>^\Xj\Zi)p^'^\Xj(Bl\Zi), 

and therefore the quantity \Z'‘Xl\ can be written as 

\Z^Xl\ = 7V,^pW(Xj aXJ©T|Zz). 


(123) 


(124) 
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